In today's computing environments, it is often desirable to backup computer data by copying and archiving the data (e.g., creating a backup image) so that the data may be restored after a data loss event (e.g., hardware failure, etc.). There are at least two types of backup applications that are implemented in this regard. File-level backup applications copy data from a source location to a backup location on a file-by-file basis regardless of where the data of the file is physically stored. This means that the backup application attempts to build and replicate the original file by reading the logical file system present on the original location. The granularity of the resulting backup entities for file-level backups is therefore individual files. Block-level backup applications, on the other hand, bypass the file system and perform backups of entire volumes of data from the original location.
One advantage of bypassing the file system for a block-level backup that there is no penalty in performance in cases where the original location contains large numbers of files (such performance impacts may take place if file-level backup were to be used). As a result of bypassing the file system, the granularity of the resulting backup entity for block-level backups is therefore the entire volume's image (i.e., binary image). Another advantage of bypassing the file system is that for certain storage volumes, a file-level backup will not capture all of the data of interest on the storage volume. For example, file-level backup may not capture data from proprietary data structures that are not contained in files of a file system built and exposed on the storage volume. Such data structures are found, for example, in various Microsoft WINDOWS™ brand operating systems and Microsoft EXCHANGE™ brand e-mail systems.
A way of block-level backup is to make and archive a full backup of a source volume on a periodic basis, and to make and archive an incremental backup of the source volume on a more frequent basis. A differential backup is another name for an incremental backup. For example, a full backup is made on a weekly basis, at 2:00 a.m. on Sunday, and an incremental backup is otherwise made on a daily basis, at 2:00 a.m. on Monday, Tuesday, Wednesday, Thursday, Friday, and Saturday. Each incremental backup includes only the blocks of data that have changed in the source volume since the previous backup. Each incremental backup also identifies all of the changed blocks. The incremental backup includes a changed block map that identifies the changed blocks, and the changed block map is a block bitmap or an extent map. A block bitmap includes a bit for each block of the source volume, and a bit set to indicate that a corresponding block of data that has changed in the source volume since the previous backup. An extent map includes entries for extents of contiguous blocks of data that have changed in the source volume since the previous backup. For example, each extent entry includes an offset and length for a corresponding extent, and the extent entries are arranged in a list sorted by offset.
For recovery from certain data loss events, it is desired to restore a source volume to a prior state existing at the time of a selected one of a plurality of available incremental backups of the source volume. The selected incremental backup may or may not be the most recent incremental backup. A case is recovery from data corruption caused by installation of a malicious or defective computer program. For example, data corruption from a virus could be detected after a few incremental backups have been made since the installation of the virus, and in this case one would select the most recent incremental backup made before the installation of the virus.
A conventional way of restoring a source volume to the time of a selected incremental backup involves copying blocks to the source volume from the most recent full backup made before the time of the selected incremental backup, and then copying blocks to the source volume from any and all incremental backups that were made between the time of this full backup and the selected incremental backup, and then copying blocks to the source volume from the selected incremental backup. These backups are copied successively to the source volume in chronological order of the backups, beginning with a full restoration of the source volume with the full incremental backup, and ending with the copying of blocks from the selected incremental backup to the source volume.